NETWORK TRAFFIC LAB: WHAT TO LOOK FOR
Fictional practice data for DMILZE EdTech. Company, people and events are invented. IP addresses use documentation and private ranges.

Open Network_Traffic_Lab.pcap in Wireshark. The office network is 192.168.10.0/24.

Questions
1. Which hosts are normal office machines, and what do they mostly do?
2. Use Statistics > Conversations. Which host talks to many ports on one server in under a second?
3. Filter: http.request.method == "POST". What is wrong with what you see?
4. Filter: dns. Which domain gets unusual queries, and from which host? What could that mean?
5. Write a one-page summary: normal traffic, three suspicious findings, and what you would do next.